What security measures does UK data protection law require?

Controllers and processors must have technical and organisational measures appropriate to the risk, taking into account the state of the art, the cost and the nature of the processing, and the law names pseudonymisation, encryption, resilience, restoration after an incident and regular testing. A processor may only act on documented instructions and under a written contract carrying the same duties. The measures must be tested and reviewed, not written once.